Assistant Vice President (AVP) of IT Security

Mount Sinai Medical Center•Miami Beach, FL

About The Position

The AVP of IT Security serves as the hospital-wide HIPAA Security Officer and leader of the healthcare system's cybersecurity program. This executive role is responsible for establishing, maintaining, and overseeing an enterprise IT Security Strategy—spanning risk assessment, prevention, vulnerability management, identity/access controls, incident response, and breach remediation. The AVP leads security governance as chair of the hospital-wide security committee, reports to executive audit/compliance boards, manages vendor security assessments, and fosters an organization-wide culture of security awareness.

Requirements

8 years of IT Security experience desired
Bachelor's Degree in related discipline
Relevant certifications such as CISSP desired

Nice To Haves

Master's Degree preferred

Responsibilities

Establish and maintain close working relationship with Privacy officer, compliance officer, internal audit, external audit, and other related constituencies.
Serve as chair of hospital-wide security committee and participate in Board-level audit and compliance committees as required
Serve as HIPAA Security Officer and ensure all aspects of HIPAA compliance are maintained
Develop and maintain an IT Security Program that addresses the needs for assessment, prevention, detection, and response to security matters
Establish a policy program and ensure all IT and Security policies are up-to-date, accurate, and communicated/trained throughout the organization
Implement Risk Assessment and Management policies
Perform regular and complete risk and vulnerability scans, and provide detailed action plans to remediate risks
Develop and publish a Security Scorecard that measures the security risks and associated KPIs
Implement policies and procedures related to user access, including role-based access profiles, user provisioning/de-provisioning processes, SSO, and regular user access audits
Lead IT incident investigations, working with internal and external groups, including forensics, eDiscovery, etc
Lead breach reporting and remediation plans when necessary
Establish security standards as it relates to network, server, workstations, end user devices, OS, etc. and ensure contracts include standard language for all new systems to define security configurations
Manage and perform assessments for all new system implementations prior to go-live
Develop a comprehensive security awareness training program, including materials, new hire orientation presentation, Leadership materials, Board briefings, and housing content on a security awareness intranet site
Serve as point of contact for vendors and service providers regarding IT Security matters
Other duties as assigned